> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # List catalog prices > The public price catalog — every rate the platform charges, effective now (or at `at`). This endpoint is public and takes no credentials: the rates are identical for every caller, with no account-specific discounts or committed-use terms, so there is nothing tenant-scoped to protect. It exists so the marketing site and the console read prices from billing instead of mirroring them in source, where they drift every time a migration reprices. Because it takes no credentials, requests are rate-limited per client IP. Responses carry a short public `Cache-Control` — the catalog changes on a migration, not on a request. ## OpenAPI ````yaml /api-reference/specs/billing.yaml get /v1/prices openapi: 3.0.3 info: title: Basaltic Billing API version: 1.0.0 description: | Prices, metered usage, invoices, payments and credits — what the account has consumed and been charged. The price catalog (`/v1/prices`) is public; everything else is scoped to the calling account. Read-only. Settling an invoice and managing payment methods happen in the console. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://billing.basaltic.sh description: Global API endpoint security: - SignatureAuth: [] paths: /v1/prices: get: tags: - Billing summary: List catalog prices description: | The public price catalog — every rate the platform charges, effective now (or at `at`). This endpoint is public and takes no credentials: the rates are identical for every caller, with no account-specific discounts or committed-use terms, so there is nothing tenant-scoped to protect. It exists so the marketing site and the console read prices from billing instead of mirroring them in source, where they drift every time a migration reprices. Because it takes no credentials, requests are rate-limited per client IP. Responses carry a short public `Cache-Control` — the catalog changes on a migration, not on a request. operationId: listPrices parameters: - name: service in: query description: Only SKUs billed by this service. schema: type: string example: compute - name: resource_type in: query schema: type: string example: instance - name: sku in: query description: Exactly one SKU. schema: type: string example: compute.instance.s1.medium - name: family in: query description: > Only SKUs whose `metadata.family` matches — how the managed products are separated from the general compute flavors. schema: type: string example: loadbalancer - name: at in: query description: > Read the catalog as of this instant instead of now, for showing a historical price. RFC3339. schema: type: string format: date-time example: '2026-01-01T00:00:00Z' responses: '200': description: The catalog effective at `as_of`. content: application/json: schema: $ref: '#/components/schemas/PriceListResponse' '400': $ref: '#/components/responses/BadRequest' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' security: [] components: schemas: PriceListResponse: type: object required: - prices - as_of properties: prices: type: array items: $ref: '#/components/schemas/Price' as_of: type: string format: date-time description: > The instant the catalog was read as of — the `at` that was asked for, or the server's clock when none was. Price: type: object description: > One effective row of the public price catalog — the same `billing.billing_prices` row rating charges against. Money is a decimal string rather than a JSON number so the quoted rate is exactly the one that will be billed. required: - sku - service - resource_type - name - unit - unit_price - currency - metadata - valid_from properties: sku: type: string description: > Stable catalog key, `{service}.{resource_type}.{variant}`. This is the public identity of a price — the row id is not published. example: compute.instance.s1.medium service: type: string description: Which service bills this SKU. example: compute resource_type: type: string example: instance name: type: string description: Display name. For compute SKUs this is the flavor name. example: s1.medium description: type: string nullable: true example: 2 vCPU, 4 GB RAM unit: type: string description: What one unit of `unit_price` buys. example: hour unit_price: type: string description: Price for one `unit`, as an exact decimal string. example: '0.085' currency: type: string example: BRL metadata: type: object additionalProperties: true description: > Extra facts about the SKU — `class`, `family`, `vcpus`, `memory_gb`, `storage_type`, … `family` separates the managed products (load balancer replicas, database cluster nodes) from the general compute flavors they share a `resource_type` with. example: class: shared vcpus: 2 memory_gb: 4 valid_from: type: string format: date-time description: When this revision took effect. valid_to: type: string format: date-time nullable: true description: > When the next revision supersedes it, or null while this is the current price. Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 responses: BadRequest: description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INVALID_INPUT message: Invalid request parameters request_id: 550e8400-e29b-41d4-a716-446655440000 TooManyRequests: description: > Rate limit exceeded. The budget is a fixed window counted per endpoint and per caller — the authenticated principal when the request carries credentials, the client IP otherwise — so one throttled endpoint never spends another's budget, and one tenant never spends another's. Wait `Retry-After` seconds, then retry. The `X-RateLimit-*` headers ride on the successful responses of a rate-limited endpoint too, so a client can pace itself instead of discovering the ceiling by hitting it. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: RATE_LIMITED message: Too many requests, please try again later request_id: 550e8400-e29b-41d4-a716-446655440000 headers: Retry-After: description: Seconds to wait before retrying. Never zero. required: true schema: type: integer minimum: 1 example: 42 X-RateLimit-Limit: description: Requests allowed per window on this endpoint. required: true schema: type: integer minimum: 1 example: 5 X-RateLimit-Remaining: description: Requests left in the current window. Always 0 on a 429. required: true schema: type: integer minimum: 0 example: 0 X-RateLimit-Reset: description: >- Seconds until the window resets — a duration, not a timestamp, so it needs no clock agreement between client and server. required: true schema: type: integer minimum: 1 example: 42 InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INTERNAL_ERROR message: An internal error occurred request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````